Binarysharp.MemoryManagement.Threading.ThreadCore.CreateRemoteThread C# (CSharp) Method

CreateRemoteThread() public static method

Creates a thread that runs in the virtual address space of another process.
public static CreateRemoteThread ( SafeMemoryHandle processHandle, IntPtr startAddress, IntPtr parameter, ThreadCreationFlags creationFlags = ThreadCreationFlags.Run ) : SafeMemoryHandle
processHandle Binarysharp.MemoryManagement.Native.SafeMemoryHandle A handle to the process in which the thread is to be created.
startAddress System.IntPtr A pointer to the application-defined function to be executed by the thread and represents the starting address of the thread in the remote process.
parameter System.IntPtr A pointer to a variable to be passed to the thread function.
creationFlags ThreadCreationFlags The flags that control the creation of the thread.
return Binarysharp.MemoryManagement.Native.SafeMemoryHandle
        public static SafeMemoryHandle CreateRemoteThread(SafeMemoryHandle processHandle, IntPtr startAddress, IntPtr parameter, ThreadCreationFlags creationFlags = ThreadCreationFlags.Run)
        {
            // Check if the handles are valid
            HandleManipulator.ValidateAsArgument(processHandle, "processHandle");
            HandleManipulator.ValidateAsArgument(startAddress, "startAddress");

            // Create the remote thread
            int threadId;
            var ret = NativeMethods.CreateRemoteThread(processHandle, IntPtr.Zero, 0, startAddress, parameter, creationFlags, out threadId);

            // If the thread is created
            if (!ret.IsClosed && !ret.IsInvalid)
                return ret;

            // Else couldn't create thread, throws an exception
            throw new Win32Exception(string.Format("Couldn't create the thread at 0x{0}.", startAddress.ToString("X")));
        }

Usage Example

Beispiel #1
0
        /// <summary>
        /// Creates a thread that runs in the remote process.
        /// </summary>
        /// <param name="address">
        /// A pointer to the application-defined function to be executed by the thread and represents
        /// the starting address of the thread in the remote process.
        /// </param>
        /// <param name="isStarted">Sets if the thread must be started just after being created.</param>
        /// <returns>A new instance of the <see cref="RemoteThread"/> class.</returns>
        public RemoteThread Create(IntPtr address, bool isStarted = true)
        {
            // Create the thread
            var ret = ThreadCore.NtQueryInformationThread(
                ThreadCore.CreateRemoteThread(MemorySharp.Handle, address, IntPtr.Zero, ThreadCreationFlags.Suspended));

            // Get the native thread previously created
            // Loop until the native thread is retrieved
            ProcessThread nativeThread;

            do
            {
                nativeThread = MemorySharp.Threads.NativeThreads.FirstOrDefault(t => t.Id == ret.ThreadId);
            } while (nativeThread == null);

            // Wrap the native thread in an object of the library
            var result = new RemoteThread(MemorySharp, nativeThread);

            // If the thread must be started
            if (isStarted)
            {
                result.Resume();
            }
            return(result);
        }
All Usage Examples Of Binarysharp.MemoryManagement.Threading.ThreadCore::CreateRemoteThread